Examkin

Soru

Zorluk: OrtaApplication and Software Vulnerabilities

During a security audit of an enterprise network management tool, an analyst reviews source code responsible for diagnostic ping tests. The function constructs shell commands using unvalidated user input:

c
char command[256];
sprintf(command, "ping -c 3 %s", user_input);
system(command);

An attacker submits the payload `127.0.0.1 && cat /etc/passwd` into the input field. Which of the following vulnerabilities is present in this application code, and what is the most effective remediation?

  1. Command injection vulnerability; remediate by using built-in network APIs or parameterizing input without passing raw strings to shell command execution functions.Cevap
  2. B
    SQL injection vulnerability; remediate by replacing the command string concatenation with database prepared statements and parameterized queries.
  3. C
    Insecure direct object reference (IDOR) vulnerability; remediate by enforcing multi-factor authentication (MFA) prior to invoking command functions.
  4. D
    Buffer overflow vulnerability; remediate by placing an inline network intrusion prevention system (IPS) to block all ICMP echo request packets.

Cevap

Command injection vulnerability; remediate by using built-in network APIs or parameterizing input without passing raw strings to shell command execution functions.
The code constructs an operating system command string using unvalidated user input and passes it directly to the system shell interpreter. The injected metacharacters cause the shell to execute an arbitrary OS command following the ping command. Remediation requires eliminating raw shell calls by using native network APIs or strictly validating input using an allowlist.

Adım Adım Çözüm

1
Analyze the source code snippet for dangerous function calls.
Identified system invocation taking a string constructed with sprintf containing raw user input.
Passing unsanitized user input directly into system shell calls enables command metacharacter injection.
2
Determine the vulnerability category.
The flaw is an OS Command Injection vulnerability.
The payload appends an arbitrary OS command after executing ping.
3
Select the appropriate primary remediation strategy.
Avoid invoking system shell interpreters or strictly validate and sanitize input against an allowlist.
Replacing system shell invocations with standard language network libraries eliminates the shell interpreter context entirely, preventing command execution.

Anahtar Kavram

OS Command Injection and Secure Input Handling
Bu soruyu puanla

Konular

Application and Software Vulnerabilities

Bu konudan daha fazla soru